Automatic determination of dynamic threshold for accurate detection of abnormalities

• US 8,457,928 B2
• Filed: 07/30/2010
• Issued: 06/04/2013
• Est. Priority Date: 03/26/2010
• Status: Active Grant

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Inventors: Dang, Derek, Scarpelli, Joe, Sodem, Sridhar, Lafaive, Alex
• Primary Examiner(s): LE, TOAN M
• Application Number:
  US12/847,391
• Publication Number:
  US 20110238376A1
• Time in Patent Office: 1,040 Days
• Field of Search: 702/186, 702/81, 702/84, 702182-183, 705 5- 6, 705 711- 722, 705 738- 739, 705/7.41, 726 22- 25
• US Class Current: 702/186
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

An improved performance management technique allows automatic determination dynamic thresholds of a metric based on a baseline of the matching pattern. A pattern matching process is conducted against a set of baseline patterns to find the matching pattern. If a matching pattern is found, the baseline of the matching pattern is used as the dynamic threshold. A series of sanity checks are performed to reduce any false alarms. If the metric does not follow any pattern, a composite of baselines is selected as the dynamic threshold.

Claims

1. A method for monitoring performance of an information technology system, the method comprising:

retrieving, by a microprocessor of a computing device, data for a metric, said metric indicative of one or more operating parameters of the information technology system;

identifying, by the microprocessor, a set of baseline patterns of the metric, each of the set of baseline patterns having a baseline;

determining, by the microprocessor, whether the data matches one of the set of baseline patterns;

if the data matches a first baseline pattern, selecting, by the microprocessor, a first baseline of the first baseline pattern as a possible dynamic threshold for the metric;

or selecting a composite baseline if there is no matching pattern;

evaluating the first baseline by conducting at least one sanity check on the first baseline to ensure that using the first baseline for the metric will result in accurate detection of abnormalities for the metric;

if the first baseline passes the at least one sanity check, applying the first baseline as a new event threshold of the metric, to dynamically adjust an event threshold for the metric.

2. The method of claim 1, further comprising:

performing pattern matching analysis on the selected baseline pattern.

3. The method of claim 2, wherein the act of performing pattern matching analysis on the selected baseline pattern comprises performing correlation analysis on the selected baseline pattern.

4. The method of claim 3, wherein the act of performing correlation analysis comprises:

generating a correlation coefficient using a correlation coefficient generating technique;

and

returning a matching status if the correlation coefficient is greater than a prespecified threshold value.

5. The method of claim 4, wherein the pre-specified threshold value is configurable.

6. The method of claim 1, wherein the at least one sanity check comprises a slow, steady increase pattern.

7. The method of claim 1, wherein the at least one sanity check comprises a slow, steady decrease pattern.

8. The method of claim 1, wherein the at least one sanity check comprises a longlasting alarms pattern.

9. The method of claim 1, wherein the at least one sanity check comprises a more alarms pattern.

10. The method of claim 1, wherein the act of selecting a composite baseline comprises generating the composite baseline by:

setting a minimum value amongst the baselines of the set of baseline patterns and a current threshold of the metric data as a lower bound of the composite baseline; and

setting a maximum value amongst the baselines of the set of baseline patterns and the current threshold of the metric data as an upper bound of the composite baseline.

11. A performance monitoring system, comprising:

a processor;

an operator display, coupled to the processor;

a storage subsystem, coupled to the processor; and

a software, stored by the storage subsystem, comprising instructions that when executed by the processor cause the processor to perform the method of claim 1.

12. A programmable storage device having programmed instructions stored thereon for causing a programmable control device to perform a method according to claim 1.

13. A networked computer system comprising:

a plurality of computers communicatively coupled, at least one of the plurality of computers programmed to perform at least a portion of the method of claim 1 wherein the entire method of claim 1 is performed collectively by the plurality of computers.

14. A method for monitoring performance of an information technology system, the method comprising:

retrieving, by a microprocessor of a computing device, data for a metric, said metric indicative of one or more operating parameters of the information technology system;

identifying, by the microprocessor, a set of baseline patterns of the metric, each of the set of baseline patterns having a baseline;

selecting, by the microprocessor, a baseline pattern from the set of baseline patterns;

performing pattern matching analysis on the selected baseline pattern;

selecting a first baseline of a matching pattern if the act of performing pattern matching analysis identifies the matching pattern;

evaluating the first baseline by conducting at least one sanity check on the first baseline to ensure that using the first baseline for the metric will result in accurate detection of abnormalities for the metric; and

if the first baseline passes the at least one sanity check, applying the first baseline as a new event threshold of the metric, to dynamically adjust an event threshold for the metric.

15. The method of claim 14, wherein the act of performing pattern matching analysis on the selected baseline pattern comprises performing correlation analysis on the selected baseline pattern.

16. The method of claim 15, wherein the act of performing correlation analysis comprises:

generating a correlation coefficient using a correlation coefficient generating technique; and

returning a matching status if the correlation coefficient is greater than a prespecified threshold value.

17. A programmable storage device having programmed instructions stored thereon for causing a programmable control device to perform a method according to claim 14.